CVE-2026-2642
Null Pointer Dereference in the_silver_searcher search_stream Function
Publication date: 2026-02-18
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ggreer | the_silver_searcher | to 2.2.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2642 is a null pointer dereference vulnerability in the_silver_searcher software up to version 2.2.0. It occurs in the function search_stream within the source file src/search.c. The vulnerability happens because the code attempts to use a file stream pointer without verifying if it was successfully opened, leading to a NULL pointer being passed to the getline function. This causes a segmentation fault or crash when the program tries to read from this invalid pointer.
The issue requires local access to the system to be exploited and has been publicly disclosed with proof-of-concept exploits available. The vulnerability results in a denial of service by crashing the application.
How can this vulnerability impact me? :
This vulnerability can cause the_silver_searcher application to crash due to a segmentation fault triggered by a null pointer dereference. This leads to a denial of service condition where the software becomes unavailable or stops functioning correctly.
Since local access is required to exploit this vulnerability, an attacker with such access can intentionally cause the application to terminate unexpectedly, potentially disrupting workflows or automated processes that rely on the tool.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by reproducing the segmentation fault caused by the NULL pointer dereference in the_silver_searcher. The detection involves running the vulnerable version of the_silver_searcher with a specially crafted input file to trigger the crash.'}, {'type': 'paragraph', 'content': 'A suggested command to detect the vulnerability is to build the_silver_searcher with Release optimization and AddressSanitizer (ASan) enabled, then execute the following command:'}, {'type': 'list_item', 'content': './ag --workers=1 -z -a "hello" repro'}, {'type': 'paragraph', 'content': 'This command runs the tool with specific flags and input that triggers the NULL pointer dereference, causing a segmentation fault if the vulnerability is present.'}] [2, 5]
What immediate steps should I take to mitigate this vulnerability?
Currently, there are no known mitigations or fixes provided by the project for this vulnerability.
Immediate steps include avoiding the use of the vulnerable versions of the_silver_searcher (up to 2.2.0) and considering alternative products to prevent exposure to this NULL pointer dereference vulnerability.
Since the attack requires local access, restricting local user permissions and monitoring for suspicious activity may help reduce risk.